The link in the Accepted Answer link text seems to no longer reach an answer to this question because of update to SPLUNK. When I try it I get page that says:
Hi! Just wanted to let you know:
The topic you've asked to see does not apply to the most recent version.
To search the latest version of the documentation, click Search
... View more